PaletteAI 1.2.0 Release Notes

Summary

PaletteAI 1.2.0 is the first stable release in the 1.2 line. It introduces system-wide configuration and federation, a new cross-scope sharing model, an automatic spoke-side inventory agent, customizable project roles, and a broad round of security and compliance hardening, on top of upgraded fleet management and expanded GPU support.

• System-wide configuration - A new System scope lets administrators define compute, settings, models, and profile bundles once and have them federate to every tenant, project, and workload-namespace spoke, with per-scope overrides and aggregate fleet and GPU inventory views. Canvas adds a dedicated System Settings area for basic info, compute, resource limits, autoscaling, target namespaces, and variables.
• Cross-scope sharing - Compute pools, compute configurations, scaling policies, and integration settings can now be shared across projects, tenants, and the system scope through a new sharing model, with read visibility governed by each user's permissions.
• Curator spoke agent - A new Curator agent is installed automatically on each managed cluster to collect the hardware and inventory details used by compute and GPU features.
• Custom project roles - Beyond the built-in viewer, editor, and admin tiers, administrators can define additional project roles with their own permission sets; the roles are applied consistently across every tenant, and an invalid role definition no longer disrupts role provisioning for others.
• Security and compliance hardening - New STIG-aligned controls include a pre-authentication notice-and-consent banner, a 10-minute session inactivity timeout, logout with single sign-on termination, Kubernetes audit events for login, logout, and failed login, and read-only container filesystems. Audit-sink credentials are now generated automatically and stored in a managed, upgrade-safe Secret instead of shipping a default username and password.
• GPU partitioning and variants - GPU configuration moves to a finer-grained variant model with Day-1 and Day-2 Multi-Instance GPU (MIG) partitioning, fleet-level MIG views, and per-variant GPU quotas.
• CLI enhancements - The paletteai CLI adds a support-bundle command and tooling for air-gapped content bundles has been extended to support all dependencies (images, charts, Packs, models, and GitHub repositories) in a single bundle.

For the complete, per-component list of changes, see Full Component Release Notes.

Upgrade Notes

1. You must upgrade the mural-crds chart to 0.7.17 before upgrading the mural chart to 1.2.0. For detailed instructions on how to upgrade PaletteAI, refer to the PaletteAI upgrade guide.

Component Versions

The following core component versions are pinned for this PaletteAI release.

Component	Version
brush	0.5.24
canvas	0.6.18
hue	0.12.28
mural-crds	0.7.17

Mural Helm values

values.yaml changes between 1.1.8 and 1.2.0

values.yaml

diff --git a/mural/charts/mural/values.yaml b/mural/charts/mural/values.yaml
index e201f047d..368ee08a2 100644
--- a/mural/charts/mural/values.yaml
+++ b/mural/charts/mural/values.yaml
@@ -28,8 +28,11 @@
 ## @param global.auditLogging.enabled Whether to enable audit logging to alertmanager. Default is true.
 ## @param global.auditLogging.alertmanagerURL The URL of the alertmanager service to send audit logs to.
 ## @param global.auditLogging.timeout Timeout for sending audit logs to alertmanager.
-## @param global.auditLogging.basicAuth.username Username for basic auth to alertmanager. Set to empty string to disable basic auth.
-## @param global.auditLogging.basicAuth.password Password for basic auth to alertmanager. Set to empty string to disable basic auth.
+## @param global.auditLogging.basicAuth.username Username for basic auth to alertmanager. Leave empty to auto-generate (stored in secretRef.name).
+## @param global.auditLogging.basicAuth.password Password for basic auth to alertmanager. Leave empty to auto-generate a random credential (stored in secretRef.name).
+## @param global.auditLogging.basicAuth.secretRef.name Name of the Secret holding the audit basic-auth credentials. Auto-generated and managed by the chart at the default name; point at your own Secret to self-manage.
+## @param global.auditLogging.basicAuth.secretRef.usernameKey Key within secretRef.name holding the username.
+## @param global.auditLogging.basicAuth.secretRef.passwordKey Key within secretRef.name holding the password.
 ## @param global.auditLogging.tls.insecureSkipVerify Whether to skip TLS certificate verification when connecting to alertmanager.
 ## @param global.auditLogging.tls.caCertSecretName Name of the secret containing the CA certificate for alertmanager TLS.
 ## @param global.auditLogging.tls.minVersion Minimum TLS version for connecting to alertmanager (e.g., "TLS12", "TLS13").
@@ -69,7 +72,7 @@ global:
   # - use a custom FleetConfig controller image with the `gke-gcloud-auth-plugin` installed
   kubernetesProvider: "Generic"
   certManagerVersion: "v1.19.1"
-  muralVersion: "1.1.8"
+  muralVersion: "1.2.0"
   dns:
     domain: "replace.with.your.domain"
     rootIngress:
@@ -90,9 +93,16 @@ global:
     alertmanagerURL: "https://alertmanager.mural-system.svc.cluster.local:9093"
     timeout: "2s"
     basicAuth:
-      # Set username and password to empty strings to disable basic auth, or change the password for production use
-      username: user
-      password: pass
+      # Audit-sink basic-auth credentials. Leave username/password empty to
+      # auto-generate a random credential, stored in the Secret named by
+      # secretRef.name and preserved across upgrades. Set them to supply your
+      # own credential, or point secretRef.name at a Secret you manage.
+      username: ""
+      password: ""
+      secretRef:
+        name: "mural-audit-basic-auth"
+        usernameKey: "username"
+        passwordKey: "password"
     tls:
       insecureSkipVerify: false
       caCertSecretName: alertmanager-tls-cert
@@ -110,7 +120,7 @@ global:
     username: ""
     password: ""
     basicAuthSecretName: ""
-  muralCrdsVersion: "0.7.8-hotfix.7"
+  muralCrdsVersion: "0.7.17"

 ## @section certificates
 ## @param certificates.clusterIssuer.spec.selfSigned The spec for the ClusterIssuer used by cert-manager to issue the Mural root CA certificate.
@@ -141,7 +151,7 @@ certificates:
 ## @param cleanup.deletionIntervalSeconds Cleanup deletion interval seconds.
 ## @param cleanup.deletionTimeoutSeconds Cleanup deletion timeout seconds.
 cleanup:
-  image: quay.io/spectrocloud-labs/spectro-cleanup:v1.7.0
+  image: quay.io/spectrocloud-labs/spectro-cleanup:v1.8.0
   imagePullPolicy: IfNotPresent
   deletionIntervalSeconds: 2
   deletionTimeoutSeconds: 300
@@ -193,6 +203,7 @@ cleanup:
 ## @param fleetConfig.hub.clusterManager.featureGates.DefaultClusterSet DefaultClusterSet feature gate.
 ## @param fleetConfig.hub.clusterManager.featureGates.ManifestWorkReplicaSet ManifestWorkReplicaSet feature gate.
 ## @param fleetConfig.hub.clusterManager.featureGates.ResourceCleanup ResourceCleanup feature gate.
+## @param fleetConfig.hub.clusterManager.featureGates.CleanUpCompletedManifestWork CleanUpCompletedManifestWork feature gate for the cluster manager.
 ## @param fleetConfig.hub.clusterManager.purgeOperator If set, the cluster manager operator will be purged and the open-cluster-management namespace deleted when the FleetConfig CR is deleted.
 ## @param fleetConfig.hub.clusterManager.resources.limits.cpu The number of CPU units to request, e.g., '800m'.
 ## @param fleetConfig.hub.clusterManager.resources.limits.memory The amount of memory to request, e.g., '8Gi'.
@@ -286,7 +297,7 @@ fleetConfig:
     ClusterClaim: true
     RawFeedbackJsonString: true
   source:
-    bundleVersion: v1.0.0
+    bundleVersion: v1.3.1
     registry: us-docker.pkg.dev/palette-images-fips/palette/spectro-ocm-bcfips
   ## @descriptionStart
   ##
@@ -897,11 +908,14 @@ fleetConfig:
       ## - **NilExecutorValidating** (ALPHA - default=false) - Enables nil executor validation
       ## - **ResourceCleanup** (BETA - default=true) - Enables automatic resource cleanup
       ## - **V1beta1CSRAPICompatibility** (ALPHA - default=false) - Enables v1beta1 CSR API compatibility
+      ## - **CleanUpCompletedManifestWork** (ALPHA - default=false) - Enables automatic garbage collection of completed manifest works
+      ## - **PlacementDebugServer** (ALPHA - default=false) - Enables the placement debug server
       ## @descriptionEnd
       featureGates:
         DefaultClusterSet: true
         ManifestWorkReplicaSet: true
         ResourceCleanup: true
+        CleanUpCompletedManifestWork: true
       purgeOperator: true
       ## @descriptionStart
       ## Resource specifications for all clustermanager-managed containers.
@@ -1168,38 +1182,18 @@ alertmanager:
   ##
   extraContainers: []
   containerPortName: &containerPortName http
+  # Audit basic-auth credentials are auto-generated and unknown at template
+  # render time, and Kubernetes probe httpGet headers cannot reference a Secret.
+  # The Alertmanager web server enforces basic auth on all HTTP endpoints
+  # (including /-/healthy and /-/ready), so TCP-socket probes are used instead.
   livenessProbe:
-    httpGet:
-      path: /-/healthy
+    httpGet: null
+    tcpSocket:
       port: http
-      # Change scheme to HTTP if TLS is not being used
-      scheme: HTTPS
-      httpHeaders:
-        # IMPORTANT: This Authorization header must be kept in sync with global.auditLogging.basicAuth.username/password
-        # The value below is Base64 encoded "user:pass" (matching the default credentials in global.auditLogging.basicAuth)
-        #
-        # If you change global.auditLogging.basicAuth credentials, you MUST regenerate this value using:
-        #   echo -n "username:password" | base64
-        #
-        # Then update the value below with the new Base64 string.
-        - name: Authorization
-          value: "Basic dXNlcjpwYXNz"
   readinessProbe:
-    httpGet:
-      path: /-/ready
+    httpGet: null
+    tcpSocket:
       port: http
-      # Change scheme to HTTP if TLS is not being used
-      scheme: HTTPS
-      httpHeaders:
-        # IMPORTANT: This Authorization header must be kept in sync with global.auditLogging.basicAuth.username/password
-        # The value below is Base64 encoded "user:pass" (matching the default credentials in global.auditLogging.basicAuth)
-        #
-        # If you change global.auditLogging.basicAuth credentials, you MUST regenerate this value using:
-        #   echo -n "username:password" | base64
-        #
-        # Then update the value below with the new Base64 string.
-        - name: Authorization
-          value: "Basic dXNlcjpwYXNz"
   service:
     annotations: {}
     labels: {}
@@ -1515,7 +1509,7 @@ brush:
   ## @param brush.image.pullPolicy The pull policy to use for the image
   image:
     repository: public.ecr.aws/mural/brush
-    tag: v0.5.18-hotfix.7
+    tag: v0.5.24
     pullPolicy: IfNotPresent
   ## @param brush.imagePullSecrets The pull secrets to use for the image
   imagePullSecrets: []
@@ -1794,6 +1788,12 @@ canvas:
   # This is a YAML-formatted file.
   # Add variables to this file as needed.

+  ## @section Global parameters
+  ## @param canvas.global.instanceName Unique name for this PaletteAI instance; also the name of the singleton `System` CR that Canvas reads/writes.
+  ## Populated by the umbrella `mural` chart from its own `global.instanceName`. When empty the deployment falls
+  ## back to `pai-system` to match the backend default (hue's `constants.InstanceName`).
+  global:
+    instanceName: ""
   ## @section Canvas parameters
   ## @param canvas.replicas Number of canvas replicas
   replicas: 1
@@ -1804,7 +1804,7 @@ canvas:
   ## @param canvas.image.pullPolicy canvas image pull policy
   image:
     repository: public.ecr.aws/mural/canvas
-    tag: v0.6.9-hotfix.7
+    tag: v0.6.18
     pullPolicy: IfNotPresent
   ## @param canvas.imagePullSecrets Image pull secrets
   imagePullSecrets: []
@@ -1989,10 +1989,10 @@ canvas:
       timeoutSeconds: 10
       failureThreshold: 5
     readiness:
-      initialDelaySeconds: 15
-      periodSeconds: 10
-      timeoutSeconds: 10
-      failureThreshold: 5
+      initialDelaySeconds: 3
+      periodSeconds: 2
+      timeoutSeconds: 3
+      failureThreshold: 15
   ## @param canvas.devspaceEnabled devspace enabled
   devspaceEnabled: false
   ## @param canvas.branding.configMapName Kubernetes name of the branding ConfigMap (default `branding`).
@@ -2003,6 +2003,7 @@ canvas:
   ## @param canvas.branding.favicon Favicon: PNG, JPEG, or octet-stream base64 data URI, or HTTP(S) URL (proxied; PNG/JPEG/GIF/SVG/WebP/ICO). Recommended source: 32×32 or 48×48 PNG or multi-size ICO; HTTP(S) max 2 MB. Empty = bundled default.
   ## @param canvas.branding.primaryLogo Primary logo for login + header (see product docs). Data URI (PNG/JPEG/octet-stream base64) or HTTP(S) URL. Recommended: ≥128×128 px square or wide mark (e.g. 256×64) with height ≥64 px; HTTP(S) max 2 MB. Empty = defaults.
   ## @param canvas.branding.secondaryLogo Secondary header logo; requires `primaryLogo`. Data URI or HTTP(S) URL; displayed up to ~32 px tall. Recommended sizing matches `primaryLogo`; HTTP(S) max 2 MB.
+  ## @param canvas.branding.notice Pre-authentication notice and consent banner text shown on the login page (STIG SRG-APP-000068 / SRG-APP-000069). When set, login controls are disabled until the user acknowledges. Rendered as plain text; newlines preserved. Empty = no banner.
   branding:
     brandColor: ""
     configMapName: "branding"
@@ -2012,9 +2013,100 @@ canvas:
     sidebarBackgroundColor: ""
     primaryLogo: ""
     secondaryLogo: ""
+    notice: ""
   ## @param canvas.fullnameOverride Fullname override
   fullnameOverride: canvas

+## @section curator
+curator:
+  ## @param curator.enabled Whether to enable the curator chart. Default is true.
+  enabled: true
+  # Default values for curator.
+
+  ## @section OCM addon parameters
+  ocm:
+    addon:
+      ## @param curator.ocm.addon.enabled Whether to create OCM addon registration resources.
+      enabled: true
+      ## @param curator.ocm.addon.name Name of the ClusterManagementAddOn and AddOnTemplate.
+      name: curator
+      ## @param curator.ocm.addon.installNamespace Namespace on the managed cluster where the curator agent is installed.
+      installNamespace: mural-system
+      ## @param curator.ocm.addon.managedClusters Managed clusters to enable the curator addon on.
+      ## Each entry creates a ManagedClusterAddOn in the managed cluster namespace on the hub.
+      managedClusters: []
+      # - namespace: hub-as-spoke
+      #   installNamespace: mural-system
+  ## @section curator agent parameters
+
+  ## @param curator.replicaCount Number of curator replicas on each spoke cluster.
+  replicaCount: 1
+  ## @param curator.image.repository Image repository for curator.
+  ## @param curator.image.tag Image tag for curator.
+  ## @param curator.image.pullPolicy Image pull policy for curator.
+  image:
+    repository: public.ecr.aws/mural/curator
+    tag: v0.0.2
+    pullPolicy: IfNotPresent
+  ## @param curator.imagePullSecrets Image pull secrets for curator.
+  imagePullSecrets: []
+  ## @param curator.nameOverride Override for the chart name.
+  nameOverride: ""
+  ## @param curator.fullnameOverride Override for the fully qualified app name.
+  fullnameOverride: curator
+  ## @param curator.podSecurityContext.seccompProfile.type Seccomp profile for curator pods.
+  podSecurityContext:
+    seccompProfile:
+      type: RuntimeDefault
+  ## @param curator.securityContext.allowPrivilegeEscalation Allow privilege escalation.
+  ## @param curator.securityContext.capabilities.drop Capabilities to drop.
+  ## @param curator.securityContext.readOnlyRootFilesystem Mount root filesystem read-only.
+  ## @param curator.securityContext.runAsNonRoot Run as non-root user.
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+  ## @param curator.resources.requests.cpu CPU request for the curator controller.
+  ## @param curator.resources.requests.memory Memory request for the curator controller.
+  ## @param curator.resources.limits.cpu CPU limit for the curator controller.
+  ## @param curator.resources.limits.memory Memory limit for the curator controller.
+  resources:
+    limits:
+      cpu: 200m
+      memory: 256Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  ## @param curator.metrics.port Port for the metrics endpoint.
+  metrics:
+    port: 8080
+  ## @param curator.healthCheck.port Port for health and readiness probes.
+  healthCheck:
+    port: 8081
+  ## @skip curator.livenessProbe
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: healthz
+    initialDelaySeconds: 15
+    periodSeconds: 20
+    timeoutSeconds: 1
+    failureThreshold: 3
+    successThreshold: 1
+  ## @skip curator.readinessProbe
+  readinessProbe:
+    httpGet:
+      path: /readyz
+      port: healthz
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 1
+    failureThreshold: 3
+    successThreshold: 1
+
 ## @skip dex
 dex:
   enabled: true
@@ -2114,10 +2206,15 @@ dex:
         hash: '$2a$12$Ot2dJ0pmdIC2oXUDW/Ez1OIfhkSzLZIbsumsxkByuU3CUr02DtiC.'
         username: 'admin'
         userID: '08a8684b-db88-4b73-90a9-3cd1661f5466'
+    # See https://dexidp.io/docs/configuration/tokens/#expiration-and-rotation-settings for all supported options.
     expiry:
       # The life time of tokens issued by Dex
       idTokens: "8h"
-      # See https://dexidp.io/docs/connectors/ for more options
+      # Session inactivity timeout (STIG SRG-APP-000190-CTR-000500).
+      # Idle sessions are logged out after this duration. Canvas resets the
+      # timer only on genuine user interaction.
+      refreshTokens:
+        validIfNotUsedFor: "10m"
   # -- Additional storage [volumes](https://kubernetes.io/docs/concepts/storage/volumes/).
   # See the [API reference](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#volumes-1) for details.
   volumes:
@@ -2409,7 +2506,7 @@ fleetconfig-controller:
     ## Source bundle for the Cluster Manager and all Klusterlets.
     source:
       ## @param fleetconfig-controller.fleetConfig.source.bundleVersion Bundle version.
-      bundleVersion: v1.0.0
+      bundleVersion: v1.3.1
       ## @param fleetconfig-controller.fleetConfig.source.registry Image registry.
       registry: quay.io/open-cluster-management
       ## @descriptionStart
@@ -2467,6 +2564,8 @@ fleetconfig-controller:
         ## - **NilExecutorValidating** (ALPHA - default=false) - Enables nil executor validation
         ## - **ResourceCleanup** (BETA - default=true) - Enables automatic resource cleanup
         ## - **V1beta1CSRAPICompatibility** (ALPHA - default=false) - Enables v1beta1 CSR API compatibility
+        ## - **CleanUpCompletedManifestWork** (ALPHA - default=false) - Enables automatic garbage collection of completed manifest works
+        ## - **PlacementDebugServer** (ALPHA - default=false) - Enables the placement debug server
         ## @descriptionEnd

         featureGates:
@@ -2476,6 +2575,8 @@ fleetconfig-controller:
           ManifestWorkReplicaSet: true
           ## @param fleetconfig-controller.fleetConfig.hub.clusterManager.featureGates.ResourceCleanup ResourceCleanup feature gate.
           ResourceCleanup: true
+          ## @param fleetconfig-controller.fleetConfig.hub.clusterManager.featureGates.CleanUpCompletedManifestWork CleanUpCompletedManifestWork feature gate.
+          CleanUpCompletedManifestWork: true
           ## @param fleetconfig-controller.fleetConfig.hub.clusterManager.purgeOperator If set, the cluster manager operator will be purged and the open-cluster-management namespace deleted when the FleetConfig CR is deleted.
         purgeOperator: true
         ## @descriptionStart
@@ -2661,7 +2762,7 @@ fleetconfig-controller:
   ## @param fleetconfig-controller.image.pullPolicy Image pull policy
   image:
     repository: us-docker.pkg.dev/palette-images-fips/palette/spectro-ocm-bcfips/fleetconfig-controller
-    tag: v0.2.4
+    tag: v0.3.5
     pullPolicy: IfNotPresent
   ## @param fleetconfig-controller.imagePullSecrets Image pull secrets
   imagePullSecrets: []
@@ -3235,6 +3336,8 @@ hue:
   projectName: ""
   ## @param hue.tenantName Owning tenant name for this spoke (`Project.spec.tenantRef.name`). Required on workload clusters for tenant-scoped OCI definition sync (`<tenantName>-tenant-spoke-definitions`) without listing Project on the spoke. Only applicable when ClusterType == spoke.
   tenantName: ""
+  ## @param hue.systemName Marks a system-scoped spoke. When set, the spoke federates via the system resource bundle (`pai-system-project-definitions`). Mutually exclusive with projectName/tenantName. Only applicable when ClusterType == spoke.
+  systemName: ""
   ## @section OCI registry parameters. If specified, OCI deployment flow will be enabled.
   ## @param hue.ociRegistry.enabled whether to enable an OCI registry for tracking Workload revisions
   ## @param hue.ociRegistry.endpoint OCI registry endpoint
@@ -3321,7 +3424,7 @@ hue:
   ## @param hue.image.pullPolicy Image pull policy
   image:
     repository: public.ecr.aws/mural/hue
-    tag: v0.12.12-hotfix.7
+    tag: v0.12.28
     pullPolicy: IfNotPresent
   ## @param hue.resources.requests.cpu hue controller deployment's cpu request
   ## @param hue.resources.requests.memory hue controller deployment's memory request
@@ -3404,6 +3507,15 @@ hue:
   ## @param hue.rbac.create Specifies whether a RBAC role should be created
   rbac:
     create: true
+  ## @param hue.projectRBAC.additionalPersonas Map of custom project RBAC personas to ship as template ConfigMaps in the Helm release namespace, beyond the built-in viewer/editor/admin tiers. Keyed by persona tier ID (the `palette.ai/project-rbac-tier` annotation value). Each entry renders a labeled template ConfigMap that Hue discovers and copies into every tenant namespace. Defaults to an empty map. Each persona accepts an optional `displayName` (human-readable label for the UI) and a required `rules` string: a YAML list of Kubernetes PolicyRule objects (same shape as `Role.rules`). Tier IDs must be DNS-1123 subdomains and must not be reserved (`tnt-adm`) or duplicate a core tier (`viewer`, `editor`, `admin`).
+  projectRBAC:
+    additionalPersonas: {}
+    #  operator:
+    #    displayName: Operator
+    #    rules: |
+    #      - apiGroups: ["spectrocloud.com"]
+    #        resources: ["aiworkloads", "computepools"]
+    #        verbs: ["get", "list", "watch"]
   ## @param hue.admissionWebhooks.enabled Whether to enable admission webhooks
   ## @param hue.admissionWebhooks.failurePolicy The failure policy for admission webhooks
   ## @param hue.admissionWebhooks.certificate.mountPath The mount path for the certificate
@@ -3438,8 +3550,11 @@ hue:
   ## @param hue.auditLogging.enabled Whether to enable sending audit logs to Alertmanager
   ## @param hue.auditLogging.alertmanagerURL The URL of the Alertmanager instance to send audit logs to
   ## @param hue.auditLogging.timeout The timeout for Alertmanager requests (default: 2s)
-  ## @param hue.auditLogging.basicAuth.username Basic auth username for Alertmanager
-  ## @param hue.auditLogging.basicAuth.password Basic auth password for Alertmanager
+  ## @param hue.auditLogging.basicAuth.username Basic auth username for Alertmanager. Ignored when secretRef.name is set
+  ## @param hue.auditLogging.basicAuth.password Basic auth password for Alertmanager. Ignored when secretRef.name is set
+  ## @param hue.auditLogging.basicAuth.secretRef.name Existing Secret with Alertmanager basic-auth credentials; when set, username/password are read from it at runtime
+  ## @param hue.auditLogging.basicAuth.secretRef.usernameKey Key within secretRef.name holding the username
+  ## @param hue.auditLogging.basicAuth.secretRef.passwordKey Key within secretRef.name holding the password
   ## @param hue.auditLogging.tls.insecureSkipVerify Skip TLS certificate verification
   ## @param hue.auditLogging.tls.caCertSecretName The secret containing the CA certificate for Alertmanager TLS verification. Must contain a 'ca.crt' key. Must exist in the release namespace.
   ## @param hue.auditLogging.tls.minVersion Minimum TLS version for Alertmanager (TLS12, TLS13)
@@ -3454,6 +3569,10 @@ hue:
     basicAuth:
       username: ""
       password: ""
+      secretRef:
+        name: ""
+        usernameKey: "username"
+        passwordKey: "password"
     tls:
       insecureSkipVerify: false
       caCertSecretName: ""
@@ -3481,7 +3600,7 @@ hue:
     enabled: true
     image:
       repository: public.ecr.aws/mural/hue-definitions
-      tag: v0.12.12-hotfix.7
+      tag: v0.12.28
       pullPolicy: IfNotPresent
       pullSecrets: []
     job:

Full Component Release Notes

The following table lists all changes made to core components in this PaletteAI release.

Per-component changes in 1.2.0

Component	Tag	Notes
brush	brush/v0.5.18	Other main: bump to go 1.26.3
brush	brush/v0.5.19	Features hue: context extension support for PaletteAI CLI studio commands Bug Fixes brush: go mod tidy hue: scope spoke cluster definition federation to Tenant namespaces Other main: bump span to latest & fix suite tests Dependency Updates deps: update brush - other go dependencies (brush) deps: update ginkgo (ginkgo)
brush	brush/v0.5.20	Features hue: prom remote-write auth component; dynamic in-context-extension value resolution Bug Fixes hue, brush: ensure managedClusters have unique names by bumping fcc to v0.3.3 Other main: bump fleetconfig-controller to v0.3.2; update topology policies to support new OCM API fields main: bump go to 1.26.4
brush	brush/v0.5.21	Bug Fixes hue: include mural HelmRelease in ComputePool readiness Other main: swap ptr.To for new
brush	brush/v0.5.22	Features curator: add curator as an ocm addon with ci integration and docs hue: implement paitest profile-bundle validate hue: system-scoped resource federation hue: tenant bundle federation to system spokes; Workload scope admission enforcement Bug Fixes brush: inject hue.tenantName for tenant workload namespace spokes Other brush: allow ocm prefix to be used for cert-manager-skip annotation brush: configure spoke helmrelease to retry without deletion main: make reviewable all main: remove deprecated ingress-nginx remnants main: update fcc to 0.3.5 Dependency Updates deps: update ginkgo (ginkgo)
brush	brush/v0.5.23	Features curator: add curator as an ocm addon with ci integration and docs hue: implement paitest profile-bundle validate hue: system-scoped resource federation hue: tenant bundle federation to system spokes; Workload scope admission enforcement Bug Fixes brush: inject hue.tenantName for tenant workload namespace spokes hue: fail-fast webhook health check for Palette API unreachability hue: include mural HelmRelease in ComputePool readiness Other brush: allow ocm prefix to be used for cert-manager-skip annotation brush: configure spoke helmrelease to retry without deletion main: make reviewable all main: release brush 0.5.21 main: release brush 0.5.22 main: remove deprecated ingress-nginx remnants main: swap ptr.To for new main: update fcc to 0.3.5 Dependency Updates deps: update ginkgo (ginkgo)
brush	brush/v0.5.24	Bug Fixes brush: grant brush get/list/watch on namespaces Performance brush: early return when system-scope
canvas	canvas/v0.6.9	Features canvas: Tenant settings Models List tab (tenant + project sub-tabs) Bug Fixes canvas: disable node pool name in PB and compute edit flow
canvas	canvas/v0.6.10	Features canvas: block App Deployment and Compute Pool creation when Project not ready canvas: Compute Config page update/revamp canvas: compute pool cluster status health indicator improvements canvas: implement hasDefinitionCreatePermission for definition creation checks canvas: playwright increase number of workers in the ci canvas: Tenant Resource Limit Revamp Bug Fixes canvas: add key value in the resource group column canvas: chore update gamut version canvas: Compute Config Page detailing and regression fixes canvas: drop playwright workers back down to 1 canvas: expose tenants listing error properly canvas: Fix deployment link canvas: HF token validation supports fine-grained tokens and detailed errors canvas: increase timeout for tenant models list test canvas: preserve existing project Settings when replacing tenant-shared HF/NVIDIA integrations canvas: unset table cell heights imposed by gamut canvas: update GPU family normalization functionality canvas: use current project namespace when cloned as well canvas: use real VIP placeholder for edge configuration hue, canvas: ensure compute status is ready even if hosts are unhealthy Other canvas: Implement Tags component canvas: move canvas to 2 spaces and 100 print lines in prettier canvas: replace all pxToRem uses in canvas to its local copy instead of gamut canvas: Support multiple VIP in compute pool shared
canvas	canvas/v0.6.11	Features canvas: hide system labels and annotations from overview/details pages canvas: Profile Bundle Import tenant scope canvas: TestRail foundation — per-area runs and mock publish canvas: TestRail CI env and tag lint canvas: TestRail Flow A sync and tag lint enhancements canvas: playwright consolidation canvas: tenant permission handling, messaging, routing improvements canvas: Tenant scoped app and model deployment canvas: tenant-aware Project creation flow with sharing and scope visibility Bug Fixes canvas: add label validations canvas: add scope column to wlp table canvas: add status revalidation for imported PB canvas: add warning on the edit palette integration drawer canvas: correct Compute Pool delete View usage links for project and tenant scope canvas: could not proceed past WLP clone/edit step 1 canvas: Fix Application workload profile variables in compute pool flow canvas: fix unique keys for wlp names canvas: limit wlp definitions to project and sys namespace canvas: Models List tenant-scoped read-only UX and omit unconfigured model settings from Project spec canvas: TestRail Flow A sync PR review fixes canvas: prevent panel close when overlays are open canvas: show notifications for repeated fetcher submissions canvas: update max char limit for names on compute pool canvas: wlp and definitions version note fix Other canvas: mv Badge from gamut to canvas canvas: Add annotation for compute pool and AIWl
canvas	canvas/v0.6.12	Features canvas: bulk @area_* and TestRail case backfill canvas: TestRail run context and result publish improvements canvas: automate view app deployment detail scenario canvas: Add Playwright clone app deployment scenario canvas: Remove Overlay Network Type field; add static overlay IP configuration when Enable Network Overlay is on canvas: Tenant creation wizard on tenant selection screen Bug Fixes canvas: Allow app and model deployment in Tenant Compute pools canvas: keep wlp toggle visible with long YAML canvas: mv + adjust gamut's accordion to canvas canvas: disable showing delete, create for system definition canvas: Make Profile bundle name consistent canvas: prevent Definition version dropdown from being cut off on CUE tab canvas: rm app deployments infra panel canvas: rm hardware requests card for model overview canvas: show disabled Previous button in WLP and Definition creation wizards hue,canvas: refactor to use new compute fields Other canvas: Add Cert manager ignore annotation in Klusterlet canvas: Fix Playwright tests canvas: mv action-menu from gamut to canvas canvas: mv banner from gamut to canvas canvas: mv button from gamut to canvas canvas: mv confirmationdialog from gamut canvas: rename openfeature flags to ui flags canvas: Rename wlp scope and variable scope column and enhance UX in profile bundle manager canvas: Update gamut version canvas: use the new util everywhere we use inline className array joins
canvas	canvas/v0.6.13	Features canvas: add Compute functional area canvas: add Quotas and API Keys functional areas canvas: add System and Tenants tabs to System Settings Compute panel canvas: add system overview and resource overview card scope st… canvas: Add tenant MIG UI settings persistence canvas: add Tenants Creation subarea to SOT config canvas: align SOT and TestRail functional area naming canvas: automate case sync in PR regression CI canvas: daily Playwright SOT backfill skill and routine canvas: emit Kubernetes audit Events on login, logout, and failed login canvas: enable system-scoped Models List editing on PaletteAISystem CRD canvas: Improve bundle manager version UX canvas: logout confirmation and dex SSO termination canvas: migrate GPU configuration forms from family to variant write path canvas: gpuVariant read helpers canvas: test-case-brainstorm SOT skill + nightly TestRail fix canvas: backend Ginkgo TestRail integration (Phase 1) canvas: per-area TestRail suites for CI publish canvas: pre-auth notice and consent banner canvas: Side bar layout changes system scope canvas: system settings basic info canvas: System Settings Settings Ref canvas: System Settings User Access canvas: taints on node pool canvas: tenant management screen rev2 canvas: warn on Models List deny changes and surface out-of-policy model deployments canvas: wire system-scoped Compute and Compute Config on PaletteAISystem CRD canvas: wire system-scoped GPU Partitioning (MIG) UI on PaletteAISystem CRD canvas: wire system-scoped Model as a Service mappings hue: backend TestRail integration Phase 2 hue: implement paitest profile-bundle validate mural: enforce 10-minute dex session inactivity timeout playwright: video on ci push to s3 span: backend Ginkgo TestRail library span: extend sot config / loader span: integration suite TestRail sync improvements Bug Fixes canvas: add import PB button on empty state canvas: add missing Profile Bundle type validations canvas: block duplicate definition creation and show clear validation feedback canvas: clarify profile bundle actions and clone source details canvas: disable two node option whenever the K8s distro is incompatible canvas: display stack trace on 500 error canvas: fix all sharing bugs canvas: fix candidate for AIWorkload incorrect WLDC canvas: fix for flaky model deployments test canvas: fix local playwright flakiness canvas: gate Palette integration warning on active workloads canvas: hide variables step when no wlp selected canvas: remove frontend manipulation of k8s data canvas: remove unreachable Change Settings Ref drawer; fix various settings-related bugs canvas: Remove VIP from table canvas: settings creation flow displays duplicate fields canvas: show baseline pool counts for empty compute configs canvas: stabilize Playwright mock tests and parallel worker port isolation canvas: surface actual webhook error on profile bundle import failure canvas: tenant settings not showing compute resources canvas: uncomment disabled canvas: Use SystemK8s list shared tenant resources canvas: Validate VIP in app deployment Flow hue,canvas,mural: rename PaletteAISystem references to System mural: enable read-only root filesystem for canvas and palette-ai surface concrete condition messages for NotReady Settings Other brush: allow ocm prefix to be used for cert-manager-skip annotation canvas: add UI mode to playwright suite canvas: bump @spectrocloud/gamut to 0.12.41 canvas: mv descriptors from gamut canvas: mv dialog from gamut canvas: mv drawer from gamut to canvas canvas: Remove duplicate notification canvas: Update Gamut version main: allow users to opt in to local hue-definitions and pai-profilebundles for dev setups mural-crds: minify crds in chart Docs canvas: update canvas onboarding guides rfc: extend RFC-0009 for backend Ginkgo TestRail integration Refactoring canvas: Compute Pool overview uses status aggregates with cluster and node pool filters
canvas	canvas/v0.6.14	Features canvas: add shared-access component library for spec.sharedWith canvas: add System and CLI functional areas 16–17 canvas: assign non-default NICs and static IP canvas: automate SOT batch canvas: display WorkloadDeployment status conditions for App/Model Deployments and ComputePools canvas: go-live daily Playwright SOT backfill under canvas: MIG day 2 canvas: MIG fleet overview canvas: migrate ComputeConfig and ScalingPolicy to spec.sharedWith map model canvas: migrate Settings integration sharing to sharedWith with system-scope editor canvas: Day 1 MIG configuration for Compute Pool worker pools canvas: System scope Compute Pools, App deployments, Model deployments, Profile bundles Feature canvas: system settings autoscaling policies canvas: system settings Resource Limits canvas: System Settings Target Namespaces canvas: system variables page Bug Fixes canvas: add PaletteAI version information canvas: align tags with SOT and add strict lint guardrails canvas: allow compute config and compute pool with control-plane-only node layout canvas: allow Models List project select to expand for long disp… canvas: fix table row incorrect cursor assignment canvas: fleet mig displays improper count canvas: format elapsed as decimal seconds for result publish canvas: harden session reads after Playwright reload navigation canvas: include system-shared resources in AIWL/CP tenant aggregate tables canvas: Project GPU limit override accepts 0 and silently clamps all project GPU limits to 0 canvas: repair stale automation refs after PR #7223 canvas: reset Resource Limits form when switching Tenant Settings tabs canvas: show only nodes from single Tenant Compute canvas: wlp name should start only with a lowercase letter test: disambiguate brush e2e refs + invalid_mapping docs Other canvas: Fix Auth guards and Notification error canvas: tweak canvas readiness probe to improve startup times Refactoring canvas: use new top-level conditions for CP status
canvas	canvas/v0.6.15	Features canvas: Add System Scope fleet overview canvas: automate SOT batch canvas: automate SOT batch canvas: automate SOT batch canvas: automate SOT batch canvas: canvas side: fix table pagination cut off on system settings tenant compute inventory canvas: source System singleton name from PALETTEAI_INSTANCE_NAME Bug Fixes canvas,gamut: disabled danger menu items show disabled color canvas: add Scope column to the Select Profile Bundle drawer canvas: dedupe edge hosts in compute table canvas: delay GPU resource validation errors until field interaction canvas: Fix shared system routes app and model deployment links canvas: fix stale variable validation errors in App and Model deployment canvas: Fix user access validation and adjust save footer in settings canvas: give system-scoped integrations their own Scope badge color canvas: normalize GPU variant matching in MIG hardware metrics canvas: prevent deletion of WorkloadProfiles and versions from scopes other than the active scope canvas: prevent GPU Variant field from squishing siblings in Modify Nodes Configuration drawer canvas: reduce RBAC noise and false failures for project-scoped users canvas: require worker pools for single-node control plane configurations canvas: show full project names in tenant Settings Ref project filter canvas: show MIG paused from SpokeNodes canvas: show pai-system as the read-only System Name on System Settings canvas: show project display names consistently in the scope switcher canvas: stabilize mock E2E cold Vite routes and hydration flakes canvas: surface built-in scaling policies in tenant and system autoscaling views span: drop SOT path prefixes for reverted Quota/APIKey CRDs Other canvas: dev flag to run canvas with no impersonation canvas: move sidebar from gamut to canvas canvas: remove 'MIG limitation' message hardcoded directly in-product
canvas	canvas/v0.6.16	Features canvas: automate SOT batch canvas: automate SOT batch canvas: playwright tests for fleet overview canvas: system display name in settings and routing canvas: tenant variable page Bug Fixes canvas: dedupe same-named ProfileBundles across scopes in app deployment wizard canvas: disable locked variable overrides in deployment wizards canvas: fix edge host NIC configuration UX and lookup bugs canvas: Helm repository edit 502s on Project chartSyncConfigs patch canvas: keep pagination on selected page for profile bundle tables canvas: label mural-system resources as Built-in scope canvas: match scope-suffixed aria-label in profile bundle drawer scope assertion canvas: omit edge.vip when network overlay is enabled canvas: prevent profile bundle error screen on clone/create version canvas: resolve Fleet Overview MIG data from SpokeNodes machine pool configuration canvas: revalidate Settings Ref table after integration delete canvas: show inherited HF/NVIDIA config on tenant Model Settings canvas: stabilize project Compute tab GPU Variant Playwright assert canvas: system-scoped, shared integration overridable canvas: update nic text to remove references to default canvas: update Project Settings Playwright tests for Display Name label canvas: Use Labels overflow on tenant overview and tenant/project cards canvas: use system for metadata in settings canvas: Worker pool display issues when single node cluster enabled Other canvas: Profile bundle sharing canvas: Remove setting ref from Compute pool and app/model
canvas	canvas/v0.6.17	Features canvas: Add global navigation loader canvas: automate SOT batch canvas: playwright System Settings recon part 1 canvas: SOT backfill 3 tests/day single 3 AM cron Bug Fixes canvas: resolve edge host NIC column from resolvedNIC, fix DNS tag removal canvas: resolve shared ProfileBundle deps via admin kubeconfig canvas: reverted the change to show 1 as default canvas: show tenant and system shared scaling policies in compute pool create/edit canvas: system-scoped compute configs not appearing in deployment wizard node config step canvas: use correct sidebar icons in wizard headers
canvas	canvas/v0.6.18	Bug Fixes hue: report a Processing phase for ProfileBundles while converging
hue	hue/v0.12.12	Bug Fixes hue: ensure all necessary ComputePool conditions for Palette-deployed clusters; track child resource deletion in PB delete step; allow defrev GC by ns controller
hue	hue/v0.12.13	Features hue: adds metricseval integration test suite hue: AIWorkloads status reflects ComputePool hue: ComputePool status reflects managedcluster being offline hue: context extension support for PaletteAI CLI studio commands hue: update cp status with health Bug Fixes hue, canvas: ensure compute status is ready even if hosts are unhealthy hue: allow project setting creation when no integrations are specified if tenant settings are shared hue: ensure scalingPolicy requeues after the defaultScrapeInterval hue: go mod tidy hue: hydrate definition status conditions properly for semantic versions hue: migration ordering for aiwls hue: only add finalizers to PB's child resources in controller hue: patch PB status separately to bypass webhooks when spec was mutated hue: project model settings scope tied to integration scope hue: remove numbered prefix from migrations hue: Run migration annotation hue: scope spoke cluster definition federation to Tenant namespaces hue: set WLP namespace in OAM ctx when validating VariableSets hue: settings, project, and compute conditions and readiness improvements; tenant with palette integration no longer creates compute hue: stop metricseval suite flaking by grabbing a random available port instead of hardcoded hue: verification of pb wlps used in wldcs hue: WorkloadDeployments are unhealthy with unready env Other hue: add debug file write for failed CP upserts main: swap ptr.Ptr for new Dependency Updates deps: update ginkgo (ginkgo) deps: update module google.golang.org/grpc to v1.81.1 (hue go-core) Refactoring hue: ManagedCluster is cluster-scoped
hue	hue/v0.12.14	Features hue-apis: Make kubeconfig and hubRef optional on imported computepools hue: allow metadata updates on invalid resources hue: auto-detect cert-manager in paitest; install by default hue: implement palette-ai-instance cleanup command hue: paitest CLI framework + palette-ai-instance deploy hue: prom remote-write auth component; dynamic in-context-extension value resolution Bug Fixes hue, brush: ensure managedClusters have unique names by bumping fcc to v0.3.3 hue: adds pb embedded tests hue: cluster profile error handling to return early on failure hue: defer ProfileBundle revision until workload profile vars parse hue: ensure spoke definition caches stay aligned with etcd; i.e. stop preserving dropped revisions hue: pb deletion causes referenced wlps to be deleted when deletionPolicy is delete hue: quick requeue of WLD during aggregate_status_step when MWRS still not created hue: remove flaky ProfileBundle dependency ordering assertions hue: set spoke-cluster-name on hub-as-spoke hue: track project definition OCI syncs per registry hue: Use additionalAnnotations for annotations Other hue: bump paletteai-profilebundles to v1.3.2 hue: bump paletteai-profilebundles to v1.3.3 hue: exclude hue/test when building devspace image hue: interface{} -> any main: bump fleetconfig-controller to v0.3.2; update topology policies to support new OCM API fields main: bump go to 1.26.4 Docs rfc: RFC-0011 Edge Host NIC Resolution
hue	hue/v0.12.15	Features hue: Support adopting Spokes to ComputePool Other hue: bump paletteai-profilebundles to v1.3.5
hue	hue/v0.12.16	Features hue: add --log-format flag for human-readable console logs hue: compute and store totalHardwareAllocated in compute pool hue: create spokenodes from computepool controller hue: maas integration settings controller hue: minimal maas client with no external deps hue: update Compute to surface NIC and StaticIP values Bug Fixes hue: allow project AIWL to deploy apps/models to tenant CP that has been shared with the project hue: detect day-2 workerNodeEligible changes on machine pools hue: improve log for project deletion stalled by pb deletion hue: include mural HelmRelease in ComputePool readiness hue: inline wlp pb deletion bug hue: populate platform annotation in manually generated OCI entries hue: prevent Workload stuck in Deleting from stale informer cache hue: skip Istio gateway auto image placeholder in mirror export Other hue: default to using log-format console for hue in devspace main: enable check-public-interface for revive lint; resolve warnings main: swap ptr.To for new
hue	hue/v0.12.17	Bug Fixes hue,canvas: refactor to use new compute fields hue: mark ComputePool ready when spoke HelmReleases report Ready hue: relax paletteai mirror export validation; allow chart-only content bundles Other hue: set required OCM spoke feature gates in test fixtures
hue	hue/v0.12.18	Features hue: Set NIC/StaticIP values during ComputePool creation Bug Fixes hue: prevent ComputePool variable sync failure on new ProfileBundle import hue: resolve reused/orphaned definition-output objects by rendered name
hue	hue/v0.12.19	Features curator: add curator as an ocm addon with ci integration and docs curator: curator dev setup work to ensure connectivity hue: add --extra-chart flag to paletteai mirror export/sync hue: add --extra-repo flag to paletteai mirror export/sync hue: add create maas cluster method to palette client hue: add maas computepool webhooks hue: add paletteai version command hue: config map hardware lookup package hue: enhances spokenodes step logic hue: make palette projectUID required, tenant name optional hue: per-backend compute availability evaluation and global rollup hue: populate GPUVariant in Compute status hue: read Alertmanager basic-auth from an existing Secret hue: remove palette integration inheritance hue: system scope foundational work Bug Fixes hue: add backend validation for project/tenant modelSettings ACLs hue: add constants and fields for gpu hue: allow scale-up when CP is in-use; ProvisioningFailed no longer marks running cluster Unhealthy hue: derive single-node mode from builder input hue: fail Settings validation for placeholder Palette configs hue: move common functions out of edgehost into hardware hue: only inject metrics addons the Hub declares hue: pack push w/ relative path; remove unused pack.yaml from paletteai mirror bundles; add E2E suite hue: preserve string type of numeric-like variable values hue: prevent race condition during default resource upsert hue: rebuild machine pools from allocated hosts without spare capacity hue: stabilize project suite Settings cleanup after Tenant delete, hue E2E ProfileBundle teardown hue: sync node-metadata changes on single-node clusters hue: sync node-metadata changes to machine pools Other hue: add profilebundle watch to cp/aiwl controllers hue: bump hue-apis; fix broken test hue: bump profile bundles ref to v1.4.0 hue: bump profile bundles ref to v1.4.1 hue: fix typo in core command long description hue: install hardware cm during devspace dev hue: swap from using dash to a pipe in gpu variant name separator hue: use %w for error wrapping main: update fcc to 0.3.5 Refactoring hue: move all Tenant RBAC initialization to the Tenant chain hue: remove ability to lock/share maas integrations hue: remove all maas code reliant on apis hue: remove palette tenant name input; clean up
hue	hue/v0.12.20	Features hue: add --extra-artifact flag to paletteai mirror export/sync hue: dynamic RBAC personas backend hue: enforce PAI <> Palette project and tenant constraints hue: PAIS controller; update system settings resolution hue: paitest support for deploying and cleaning up real profile bundles hue: resolve effectiveMIGUISettings for tenants hue: SharedWith read-visibility RBAC hue: switch to BuiltInNamespace in hue + scope resolution and audit hue: system-scoped settings Bug Fixes hue: PAISystem controller fixes hue: retry tenant spoke OCI sync when registry targets are not ready hue: SharedWith as a ptr mural: avoid nil issues when installing via Helm SDK w/ default values; default zot to terminate TLS at the Traefik LB Other hue: add comp name to parse error main: sync hue-apis types/ into hue devspace pod
hue	hue/v0.12.21	Features hue: add --extra-pack for Artifact Studio Pack content bundles hue: add support-bundle CLI subcommand hue: aggregate system gpu utilization; validate projects, tenants against sys hue: backend TestRail integration Phase 2 hue: GPUVariant migrations hue: GPUVariant refactor hue: implement bundle template sync to tenant, system hue: implement paitest profile-bundle validate hue: migrate SharedWithProjects to SharedWith (backfill, clear, webhook) hue: migrate system variableset to pai-system hue: parse profileBundle.content for mirror pull/sync hue: SharedWith lifecycle consistency — enqueue + shardWith pruning hue: system compute step hue: system scoped rbac sharing for AIWL hue: system-scoped resource federation hue: tenant-scope read RBAC prefers SharedWith; hash-based system-scope Role names Bug Fixes hue,canvas,mural: rename PaletteAISystem references to System hue: backfill ProfileBundle addon variant names in controller hue: better errors for out of policy hue: compare spec instead of generation in SpecUnchanged hue: federate tenant resources to tenant-workload-namespace spokes hue: harden computepool orphan flows hue: retry ProfileBundle project sync in all edge cases; respect pause annotation for ComputePools hue: tests for shared with migrations hue: worker pool cycling due to un-named worker pools mural: restore zot serviceHeadless.enabled default to false Other hue: bump profile bundles ref to v1.4.2 hue: bump profile bundles ref to v1.4.3 hue: update hue/config/samples main: bump profile bundles ref to v1.5.0 main: make reviewable all Dependency Updates deps: update ginkgo (ginkgo)
hue	hue/v0.12.22	Features hue: add validation webhooks for Quota and APIKey resources hue: adds 'Blocked' state to node pool scaling fsm hue: SharedWith glob/negation policy engine hue: system scoped computepools, workloads hue: tenant bundle federation to system spokes; Workload scope admission enforcement Bug Fixes hue: allow in-place sharedWith updates for PBs hue: bump hue-apis and fixes hue: deprioritize GPU hosts for control plane selection hue: fail AIWorkload when WorkloadDeploymentConfigs cannot deploy hue: spokenodes unit test failure after mig refactor hue: strip OCM finalizers on force-delete to unblock offline-spoke ComputePool deletion hue: support worker-eligible control plane with no worker pools Refactoring hue: consume metav1 conditions across all v1beta1 chains hue: unify condition management across all controller chains
hue	hue/v0.12.23	Features hue: add manifest samples for quota and api key resources hue: adds ComputePool.status.hardwareCapacity for gpus and mig data hue: adds curator-hardware-specs-role Role in BuiltInNamespace for hw lookup table access hue: adds mig and node auto scaling coordination hue: computeconfig, scalingpolicy migrations for sharedWith hue: move cross-resource validation from webhooks to controller for migrated resources hue: populate ComputePool status.workloadDeployments hue: Quota and APIKey Controllers hue: Settings integration sharing via SharedWith (webhook, migration, reads) hue: system-scope model settings + tenant effective model settings step hue: system-scope Settings sharing cascade hue: system-scoped resource deletion hue: watch System to re-enqueue Projects and Settings Bug Fixes canvas: align tags with SOT and add strict lint guardrails canvas: repair stale automation refs after PR #7223 hue: align w/ Palette-reported gpu-memory semantics: value is per-GPU memory hue: allow deletion of out-of-policy Workloads hue: block tenant deletion with active tenant-scoped workloads hue: correctly allocate single-node clusters on day 1; address unit test coverage gap hue: enforce ClusterVariant GPU quota in AIWorkload controller hue: expand sharedWith "*" wildcard in system ComputePool federation hue: mock context extensions during hub variable resolution hue: sync-validate-schema before test-unit to fix regression suite hue: truncate paitest WorkloadProfile names to fit WorkloadDeployment webhook cap hue: widen rbac scope for curator Other hue: remove extra comments from migration steps hue: simplify comment before sharedWith migrations Refactoring hue: move cross-resource validation from webhooks to controller for prj/varset hue: move most ProfileBundle validation to controller; stabilize ProfileBundle webhooks and controller hue: settings-sharing cleanup pass (naming, package placement, dedup) hue: use sharedWith for ComputeConfig, ScalingPolicy
hue	hue/v0.12.24	Features hue: add displayName to system spec Bug Fixes hue: enforce SharedWith on cross-scope resource references hue: enforce that users select a NIC when multiple NICs exist on the host hue: provide better error messages when we fail to find eligible edge hosts Other hue: bump hue-apis version in /hue and /test hue: bump paletteai-profilebundles to v1.6.0
hue	hue/v0.12.25	Features hue: source System singleton name from --instance-name Bug Fixes hue: allow empty VIP when overlay is enabled hue: backport kubevela/kubevela/pull/7226,7217 + associated refactors hue: ensure compute does not filter out unhealthy hue: fall back to system limits if tenant not explicitly set hue: set edge control plane VIP from overlay CIDR when overlay is enabled hue: sync AllocatedMachinePool nodeType on day-2 pool updates hue: WaitForTermination on Workload/WorkloadDeployment kustomizations Other hue: expose Palette error when validating integration
hue	hue/v0.12.26	Features hue: add xdefs-namespace annot to WLP/WL; set them via PB controller hue: sync shared and deleted clusterprofiles to palette Bug Fixes canvas: dedupe same-named ProfileBundles across scopes in app deployment wizard hue: fault-isolate invalid persona ConfigMaps in project RBAC hue: omit system-scoped resources from tenant bundle on system spokes Other hue: address feedback on ClusterProfile sync Performance hue: drop transient annots from def bundles to prevent churn
hue	hue/v0.12.27	Features hue: add migration to nuke orphaned federation flux resources hue: exclude edge hosts without a resolved NIC from autoscaling hue: pin resolvedNIC for in-use edge hosts on NIC changes Bug Fixes hue: allow tenant namespaces for workloadProfileRefs and scalingPolicyRefs hue: read from effective tenant model settings hue: validate CP for cross-scope copy; handle cross-scope 403 from Palette Other hue: bump profilebundles to v1.6.2 hue: skip cp ops on all invalid Palette integrations Performance hue: prevent more pointless churn Refactoring hue: split def & tenancy federation to prevent ownership conflicts
hue	hue/v0.12.28	Bug Fixes hue: report a Processing phase for ProfileBundles while converging
mural-crds	mural-crds/v0.7.8	Features hue-apis: Add Unknown to ComputePool status
mural-crds	mural-crds/v0.7.9	Features hue-apis: update compute API to list unhealthy edge hosts hue: adds cluster health field to cp status
mural-crds	mural-crds/v0.7.10	Features hue-apis: add actual hardware allocation status fields to compute pool hue-apis: Make kubeconfig and hubRef optional on imported computepools hue-apis: settings maas integration types hue: adds SpokeNodes crd hue: API changes to resolve context extension references by label Bug Fixes hue, brush: ensure managedClusters have unique names by bumping fcc to v0.3.3 hue: make SpokeNodes Status omitempty Other hue-apis: clarify GPU quota godocs on Tenant and Project main: bump fleetconfig-controller to v0.3.2; update topology policies to support new OCM API fields
mural-crds	mural-crds/v0.7.11	Features hue-apis: add AppliedClusterProfileUIDs field to PaletteClusterStatus hue-apis: add MetadataHash to AllocatedMachinePool hue-apis: compute type supports maas machines hue-apis: configure types for NIC and StaticIP selection Other hue: add OCM work CRDs
mural-crds	mural-crds/v0.7.12	Features hue-apis: add additionalRoles to ProjectRoleMapping for dynamic RBAC personas hue-apis: add gpu utilization to system status hue-apis: add maas fields to computepool API hue-apis: add MIG types to GPUResource for HardwareCapacity hue-apis: Add MIGUISettings hue-apis: add Quota and ApiKey resources hue-apis: add SharedWith to AIWorkloads; deprecate SharedWithProjects; update SharedWith docstrings hue-apis: add SharedWith to settings and effectiveModelSettings to Tenant hue-apis: add system to integration scope enum hue-apis: add tenantUID to palette status hue-apis: adds 'Blocked' state to node pool scaling fsm hue-apis: adds spokenodes.status fields hue-apis: configure GPUVariant type hue-apis: introduce PaletteAISystem CRD hue-apis: make Quota spec.scope immutable via CEL validation hue-apis: make tenant name optional, projectUID required hue-apis: per-role machine availability on compute groups hue-apis: sharedWith system level hue-apis: SharedWith wildcard model with explicit sharing hue-apis: swap from using dash to a pipe in gpu variant name separator hue-apis: update mig api hue-apis: update remainder of APIs to use variant instead of family hue: implement paitest profile-bundle validate Bug Fixes hue-apis: docstring for MIGTarget.NodeSelectorTerms hue-apis: nullable map hue-apis: remove maas exposed apis hue-apis: rename PaletteAISystem to System hue: worker pool cycling due to un-named worker pools Other hue-apis: clean up family -> variant rename in system api hue-apis: fix docs comments on PoolScalingState field mural-crds: install both versions of OCM addon CRDs mural-crds: minify crds in chart Refactoring hue-apis: migrate v1beta1 conditions to metav1.Condition hue-apis: remove ability to lock/share maas integrations
mural-crds	mural-crds/v0.7.13	Features hue-apis: add ComputePool status workloadDeployments hue-apis: add Ready to variableset status hue-apis: add ResetSchedule type and integrate into QuotaStatus hue-apis: add top-level conditions to computepool status hue-apis: new sharedWith fields for computeconfig & scalingpolicy hue-apis: enhance System and AIWorkload CRD specifications with model pricing and serving details Bug Fixes hue-apis: set default value for optional bool hue: align w/ Palette-reported gpu-memory semantics: value is per-GPU memory
mural-crds	mural-crds/v0.7.14	Features hue-apis: add displayName to system spec hue-apis: drop System singleton name CEL rule Other hue-apis: update APIs for compute to ignore default NIC reported by palette
mural-crds	mural-crds/v0.7.15	Bug Fixes hue-apis: make VIP optional on EdgeDeployConfig hue: fall back to system limits if tenant not explicitly set
mural-crds	mural-crds/v0.7.16	Features hue-apis: add map of synced CPUIDS to PB status
mural-crds	mural-crds/v0.7.17	Features hue-apis: add Processing to the ProfileBundle status enum